HashiCorp Vault Associate (003) Question 199
Single answer7c Configure environment variablesA platform engineer is preparing a bastion host for administrators who will use the Vault CLI against a development Vault cluster. The cluster uses a self-signed TLS certificate, and the team wants to avoid repeatedly typing the server address and CA certificate path for every command. They also want to reduce the chance that an administrator accidentally targets the wrong Vault server from that host. Which environment variable configuration best meets these requirements without disabling TLS verification?
- A
Set VAULT_ADDR to the Vault HTTPS URL and set VAULT_CACERT to the path of the CA certificate file used to validate the server certificate.
- B
Set VAULT_ADDR to the Vault HTTPS URL and set VAULT_SKIP_VERIFY=true so the CLI can connect to the self-signed certificate safely.
- C
Set VAULT_TOKEN to the administrator's token and set VAULT_NAMESPACE to the cluster name so the CLI automatically trusts the certificate.
- D
Set VAULT_CLIENT_CERT to the server certificate file and set VAULT_CLIENT_KEY to the CA certificate file so the CLI can verify the Vault server.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure VAULT_ADDR and VAULT_CACERT. In practice, administrators commonly export VAULT_ADDR so the Vault CLI consistently points to the intended server, reducing mistakes across environments. When Vault uses a certificate signed by a private or self-signed CA, the CLI must be told which CA to trust; VAULT_CACERT provides that path while preserving TLS verification. By contrast, VAULT_SKIP_VERIFY bypasses verification entirely and is not a best practice except for limited troubleshooting or nonsecure test usage. HashiCorp Vault CLI documentation and environment variable references describe VAULT_ADDR for the target server address and VAULT_CACERT for TLS trust configuration.
- A. Correct.
Correct. VAULT_ADDR tells the CLI which Vault server to contact, which helps prevent accidentally targeting the wrong server. VAULT_CACERT points the CLI to a PEM-encoded CA certificate file used to validate the Vault server's TLS certificate. This is the standard way to work with a private or self-signed CA while keeping TLS verification enabled.
- B. Incorrect.
Incorrect. VAULT_SKIP_VERIFY disables TLS certificate verification, which weakens security and does not meet the requirement to avoid disabling verification. Although some users choose this in test environments for convenience, it is not the best configuration when a CA certificate is available.
- C. Incorrect.
Incorrect. VAULT_TOKEN can authenticate the CLI, and VAULT_NAMESPACE is used with Vault Enterprise namespaces, but neither setting establishes trust for a self-signed TLS certificate. This option mixes unrelated environment variables and reflects a common misconception that authentication settings affect TLS validation.
- D. Incorrect.
Incorrect. VAULT_CLIENT_CERT and VAULT_CLIENT_KEY are used for client certificate authentication, where the client presents its own certificate to Vault. They are not how the CLI validates Vault's server certificate. Also, using the server certificate as a client certificate and the CA cert as a client key is conceptually incorrect.